{"id":"CVE-2026-62022","published":"2026-10-10T20:16:38.630","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-266"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/tonda-membership/vulnerability/wordpress-tonda-membership-plugin-1-0-1-privilege-escalation-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Tonda Membership plugin allows unauthenticated users to escalate privileges to administrator level, enabling full control over the affected WordPress site without requiring any login credentials or prior access.","exploitability":"Exploitation is straightforward with no prerequisites, as the vulnerability affects all versions up to and including 1.0.1 and requires no authentication to trigger the privilege escalation.","blast_radius":"The impact could be severe across many WordPress installations running the vulnerable plugin, potentially leading to complete site compromise, data theft, or unauthorized content modification by any attacker with access to the web application.","remediation":"Upgrade to version 1.0.2 or later which contains the fix for this privilege escalation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","wordpress","plugin"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:46:43.696Z"}}